Skip to Content

Ermetic Researchers Find Cross-site Request Forgery Flaw in Azure Cloud Services

Researchers from Ermetic have detailed their findings of a cross-site request forgery (CSRF) vulnerability affecting Azure cloud services. The flaw, dubbed EmojiDeploy, can be exploited to achieve remote code execution. The vulnerabilities are due to a series of misconfigurations and bypasses in the Kudu back-end source control management tool. Microsoft was alerted to the issues in October 2022 and addressed them in early December.

EmojiDeploy Attack Flow


  • This item, and the similar Server-side Request Forgery (SSRF) vulnerability found by Orca in Azure, point out 3 key issues: (1) Cross-site Request Forgery was on the OWASP Top 10 for many years, Server-Side Request Forgery is on the list for 2022. I’d like to hear some lessons learned from Microsoft about why these were in Azure code when so many tools find them easily. (2) Azure was patched when the patches were ready – Microsoft did not have to wait until the monthly Vulnerability Tuesday. (3) We still see external parties (good guys with responsibly disclosed vulnerabilities and bad guys exploiting zero days) being credited on the majority of patches that come out in Windows. This all adds up to faster patching is still important and the monthly patch cycle is like using a 4800 baud modem for IT ops hygiene when the bad guys are on gigabit connections.


Alex Lim is a certified IT Technical Support Architect with over 15 years of experience in designing, implementing, and troubleshooting complex IT systems and networks. He has worked for leading IT companies, such as Microsoft, IBM, and Cisco, providing technical support and solutions to clients across various industries and sectors. Alex has a bachelor’s degree in computer science from the National University of Singapore and a master’s degree in information security from the Massachusetts Institute of Technology. He is also the author of several best-selling books on IT technical support, such as The IT Technical Support Handbook and Troubleshooting IT Systems and Networks. Alex lives in Bandar, Johore, Malaysia with his wife and two chilrdren. You can reach him at [email protected] or follow him on Website | Twitter | Facebook

    Ads Blocker Image Powered by Code Help Pro

    Your Support Matters...

    We run an independent site that is committed to delivering valuable content, but it comes with its challenges. Many of our readers use ad blockers, causing our advertising revenue to decline. Unlike some websites, we have not implemented paywalls to restrict access. Your support can make a significant difference. If you find this website useful and choose to support us, it would greatly secure our future. We appreciate your help. If you are currently using an ad blocker, please consider disabling it for our site. Thank you for your understanding and support.